{
  "verdict": "reproduced",
  "impact": "leak",
  "confidence": "certain",
  "kernel_refs": [
    "sys/dev/misc/ipmi/ipmi_smic.c:320-336",
    "sys/dev/misc/ipmi/ipmi_smic.c:341",
    "sys/dev/misc/ipmi/ipmi_smic.c:346-350",
    "sys/dev/misc/ipmi/ipmi.c:448-468",
    "sys/dev/misc/ipmi/ipmi.c:401-403",
    "sys/dev/misc/ipmi/ipmi.c:534-546",
    "sys/dev/misc/ipmi/ipmi.c:831-832",
    "sys/sys/ipmi.h:35",
    "sys/dev/misc/ipmi/ipmi_kcs.c:411-432"
  ],
  "reproduce": {
    "build": "guest# sh /root/smicshock/build.sh   (module compiles the VERBATIM /usr/src ipmi_smic.c via -DLOCAL_MODULE + mock <ipmivars.h> INB/OUTB; sink needs QEMU '-device ipmi-bmc-sim,id=bmc0 -device isa-ipmi-kcs,bmc=bmc0' and 'kldload ipmi')",
    "run": "guest# kldload /root/smicshock/smicshock.ko ; dmesg | tail   -> ir_replylen=16000 for a 1024-byte buffer (BUG DF-4948 REPRODUCED). Then end-to-end: maxx$ /tmp/leak & ; root# sysctl hw.bumpreplylen=16000 ; cat /tmp/leak.out",
    "expected": "producer: smic_polled_request()=1, req->ir_replylen=16000, req->ir_replybuflen=1024, 'SMIC: Read short: 1024 buffer, 16000 actual'. sink (3/3 runs): RECEIVE ok msg.data_len=16001, 6624-7167 nonzero kernel bytes beyond offset 1024 (first at 0x042e), kernel pointers 0xfffff8008dcfxxxx, 392-424 marker fragments. After fix.diff + kernel rebuild: ir_replylen=1024, msg.data_len=1025, zero bytes beyond 1024."
  },
  "artifacts": [
    "README.md", "VERDICT.md",
    "smicshock.c", "mock/ipmi.h", "mock/ipmivars.h", "Makefile",
    "bumpko.c", "leak.c",
    "build.sh", "run.sh",
    "build.log", "run.log", "run.2.log", "run.3.log",
    "fix.diff", "fix_build.log", "fix_run.log",
    "leak_sample.txt", "env.txt", "dmesg.txt",
    "manifest.json", "verdict.json"
  ]
}